Homey WordPress Theme Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in the Homey theme for WordPress, affecting all versions through 2.4.2. The issue arises because the theme allows users registering new accounts to choose their own roles. This functionality can be exploited by unauthenticated attackers to create accounts with elevated privileges, such as Editor or Shop Manager roles.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain elevated privileges by creating accounts with roles that have higher access rights, such as Editor or Shop Manager.

Remediation

Users can update to version 2.4.3 or a newer patched version to address this vulnerability.